CVE-2020-36396

A stored cross site scripting XSS vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter...

CVE-2020-36397

A stored cross site scripting XSS vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter...

Cross site scripting

A stored cross site scripting XSS vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter...

CVE-2020-36397

A stored cross site scripting XSS vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter...

CVE-2020-18166

Unrestricted File Upload in LAOBANCMS v2.0 allows remote attackers to upload arbitrary files by attaching a file with a ".jpg.php" extension to the component "admin/wenjian.php?wj=../templets/pc"...

The vulnerability of the Admin component of Oracle Advanced Collections, a component of the Oracle E-Business Suite, allows an attacker to gain access to modify, add, or delete data, as well as to gain unauthorized access to protected information.

The vulnerability of the Admin component in Oracle Advanced Collections, a component of the Oracle E-Business Suite, relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to modify, add, or delete data, as well as gain unauthorized...

Oracle Primavera Gateway (Jan 2021 CPU)

The version of tested product installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the January 2021 CPU advisory. - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering component: Admin...

The vulnerability of the Admin component in the Oracle iSupport web application allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Admin component in the Oracle iSupport web application is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information via the HTTP network protocol...

The vulnerability of the Setup and Admin components of the Oracle Knowledge Management application allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Setup and Admin components of the Oracle Knowledge Management application is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information using the HTTP network...

Design/Logic Flaw

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite component: Admin. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require...

Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke

Cross-site scripting XSS is possible in DNN formerly DotNetNuke before 9.4.0 by remote authenticated users via the Display Name field in the admin notification function...

The vulnerability of the Setup and Admin components of Oracle Knowledge Management, a business automation system from Oracle E-Business Suite, allows an attacker to access, modify, add, or delete data.

The vulnerability of the Setup and Admin components of Oracle Knowledge Management, a system for automating business activities within the Oracle E-Business Suite, is related to lack of access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to...

CVE-2018-18934

An issue was discovered in PopojiCMS v2.0.1. admincomponent.php is exploitable via the po-admin/route.php?mod=component&act=addnew URI by using the fupload parameter to upload a ZIP file containing arbitrary PHP code that is extracted and can be executed. This can also be exploited via CSRF...

Mitel MiVoice Office 400 web admin component cross-site scripting vulnerability

Mitel MiVoice Office 400 is a small and medium-sized business communications solution from Mitel Canada. The product includes features such as video conferencing, voice calls, etc. web admin is one of the web-based management components. A cross-site scripting vulnerability exists in the web admi...

CVE-2018-12465 Remote Code Execution in Micro Focus Secure Messaging Gateway

An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway SMG allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve...

CVE-2018-2770

Vulnerability in the Oracle Adaptive Access Manager component of Oracle Fusion Middleware subcomponent: OAAM Admin. The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Adaptive Acce...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in admin/themes/default/pages/manageusers.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 user.email or 2 user.website field in a...

CVE-2014-7264

Multiple cross-site scripting XSS vulnerabilities in admin/themes/default/pages/manageusers.twig in the Users Management feature in the admin component in Chyrp before 2.5.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 user.email or 2 user.website field in a...

CVE-2014-2455

Technical details for CVE-2014-2455 are not publicly available in the provided documents. Monitor for updates from official advisories; no specific affected product versions, root cause, or remediation are disclosed here.

joomlaradio-rfi.txt

Joomla Radio v5 Component RFI Bug in : administrator/components/comjoomlaradiov5/admin.joomlaradiov5.php Variable : $mosConfiglivesite Download : http://www.joomlaos.de/option,comremository/Itemid,41/func,fileinfo/id,2661.html Dork: inurl:"comjoomlaradiov5" Example:...